dcd7e3b0a315b9830d92f80f4e9c43b18e8a771246934b52f73f58caa9827bde

Resubmissions

12/10/2026, 12:42

261012-pxdcsawvdv10

12/10/2026, 12:19

261012-phgrnavzct10

Analysis

max time kernel
683s
max time network
685s
platform
android-11_x64
resource
android-x64-arm64-20260325-en
resource tags

arch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20260325-enlocale:en-usos:android-11-x64system
submitted
12/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bomber_v8_signed.apk_Binded.apk
Size 6.4MB
Sample261012-phgrnavzct
SHA256 dcd7e3b0a315b9830d92f80f4e9c43b18e8a771246934b52f73f58caa9827bde
MD5 680a1958889a2912c2c21883b69c5dcf
SHA1 a7b8d87c08236d99d4d6b3b829ec4673a47d4ca2
SHA512 149a35b2dcd1bfd82cf79a0c41e493da2bd28eb7f0964514bf6bc0b368511bb9ef1a0fd05a75218e2df34d1db63ba82157a0994379aa06463902420682e6903d
SSDEEP 196608:3btaeYyie32OCJEEWAU0WtrkaQTfC91qDv:3bSyieGOCJEDZhQTLb
TLSH
T1A666D056FB48A92BC4F343764D7A1223650B4C268753C7D7AD04727C28B7AD0CE9AED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery evasion execution impact persistence

Malware Config

Signatures

Checks if the Android device is rooted. 1 TTPs 2 IoCs

defense_evasion

System Information Discovery

T1426

ioc	Process
/system/app/Superuser.apk	cc.bomber
/system/xbin/su	cc.bomber

Loads dropped Dex/Jar 1 TTPs 2 IoCs

Runs executable file dropped to the device during analysis.

evasion

Download New Code at Runtime

T1407

ioc	pid	Process
/system_ext/framework/androidx.window.sidecar.jar	4883	cc.bomber
/system_ext/framework/androidx.window.sidecar.jar	4883	cc.bomber

Makes use of the framework's Accessibility service 4 TTPs 1 IoCs

Retrieves information displayed on the phone screen using AccessibilityService.

collection defense_evasion credential_access

Input Injection

T1516

Screen Capture

T1513

Keylogging

T1417.001

GUI Input Capture

T1417.002

description	ioc	Process
Framework service call	android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId	cc.bomber

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	cc.bomber

Queries information about running processes on the device 1 TTPs 1 IoCs

Application may abuse the framework's APIs to collect information about running processes on the device.

discovery

Process Discovery

T1424

description	ioc	Process
Framework service call	android.app.IActivityManager.getRunningAppProcesses	cc.bomber

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	cc.bomber

Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

Application may abuse the framework's foreground service to continue running in the foreground.

defense_evasion persistence

Foreground Persistence

T1541

description	ioc	Process
Framework service call	android.app.IActivityManager.setServiceForeground	cc.bomber

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	cc.bomber

Reads information about phone network operator. 1 TTPs
discovery

System Network Configuration Discovery
T1422
Checks the presence of a debugger
defense_evasion

Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

execution persistence

Scheduled Task/Job

T1603

description	ioc	Process
Framework service call	android.app.job.IJobScheduler.schedule	cc.bomber

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	cc.bomber

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	cc.bomber

cc.bomber
1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Makes use of the framework's Accessibility service
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Acquires the wake lock
- Makes use of the framework's foreground persistence service
- Queries information about active data network
- Schedules tasks to execute at a specified time
- Checks CPU information
- Checks memory information
PID:4883

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Scheduled Task/Job

T1603

Persistence

Foreground Persistence

T1541

Scheduled Task/Job

T1603

Privilege Escalation

Defense Evasion

Download New Code at Runtime

T1407

Foreground Persistence

T1541

Input Injection

T1516

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Discovery

Process Discovery

T1424

System Information Discovery

T1426

System Network Configuration Discovery

T1422

System Network Connections Discovery

T1421

Lateral Movement

Collection

Clipboard Data

T1414

Input Capture

T1417

GUI Input Capture

T1417.002

Keylogging

T1417.001

Screen Capture

T1513

Command and Control

Exfiltration

Impact

Data Manipulation

T1641

Transmitted Data Manipulation

T1641.001

Input Injection

T1516

Replay Monitor

Loading Replay Monitor...

Downloads

primary.prof

Path /data/misc/profiles/cur/0/cc.bomber/primary.prof
Size 2KB
SHA256 fd24fdec96ae4a0f4c2362c1a8fc1f16f29bee9b352610e8b259203c20378925
MD5 0be384b044e954bfa2d7d5880f2b8b1a
SHA1 bebb39321846c134102cea00a7e743019ba7ffb8
SHA512 5b9dd7057bb440eaecf6fec86eb9195924b82e82f54a3926fb618b612c99c239fd2b7b1d968a5cf12391acd7509c920e0a5b6ec65e12888d69c9ac5c825e4f18
TLSH
T148518E62E757BDA04FE7A21827D63D3D6D104124BE924E4075D213DF6C883CC9B46382
MD5 SHA1 SHA512 TLSH

Submit Download

primary.prof

Path /data/misc/profiles/cur/0/cc.bomber/primary.prof
Size 12KB
SHA256 49824ea652fe515353574c5084e8f9e1c3db7b44f8253f5a4450b5fe98b025c1
MD5 7982493752cb651e6cec82031cdbeab2
SHA1 2e6428108edbcd06fd12d042b9da9d9eda88e09c
SHA512 5eb797d152e8bee3fb1907425153e424d8fd2e04f95a2ecfce0bc8ee46086905847d6b9f276316211c57f1cd44236a67b51d28fa18eec7e32e86e642134c85b5
SSDEEP 192:0HKvgvC3J2GebiiKlUuLx9xxZyC2g1N7t4ytLbrmmbHnuhuhAWWUYuwDU2YEMjYH:0HKvgq2dii3KJvyRgeiHG7J3YRjYAbs
TLSH
T17F42C0910E8CBF33A0296EC81D9F998E9A7A72C9557E7160118DE0D6776448CDE01C5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events
Size 56KB
SHA256 061c9e23ef9c17a747a995e066df36dea99e9ccdc2604699c8e571fac220de32
MD5 6666a9b9d133f6221f738eab6632e77c
SHA1 9b00f936d74ac5b4b8b606e34de2a6006051fcd2
SHA512 489f80dfcf38d86edb51af6e469d5530b64ceffd2f6c0871c66ce4af6577ef162f93dfc7c6c784b071717b387a0513a87fc44b451f262d05d51e4caddbec87d1
SSDEEP 48:TG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSw5lFXfb7tFXfbkD:WMEqzAiwIyNja8Lb7jbkD
TLSH
T14A43855D5B3C3221CA6E683DD7E247A32B7C83CF977292213E949DE68CC20657C354A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 24KB
SHA256 a2378cc7aa92ae977f9d37e39fd41485fd4b9ef51d4fa15d19e7b1233e4cb2ae
MD5 14e85fdd0af9692a1784e9ee6b5abde1
SHA1 bcacc08cd956dc5fa2f8e70d29468039ed99e515
SHA512 039bdd99f5bc4dc4e08b33f00b9a2b6d5d3c63e40d3342e67888cd1cf987278623466f8d0a088e02962b729e6f64209d63d2e4f48b561fbd5b53e94a7e29f669
SSDEEP 48:7MlIZqG59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSf:7QI9MEqzAiwIyNjaf
TLSH
T19BB2859D5D3C2310C6BE283ED7E102935D3C53DF6723A1603EA49CFA8DC2469B0354AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 16KB
SHA256 d9afee56ad66725ea3cd21545980e053295c9ebf4818f2812526c2e7e3f8a999
MD5 3a7fd33b1f655bf87f0d9ea67ff35469
SHA1 fb1150227aa21debc224d6dfae577224ed8cd810
SHA512 686835f5f1917b2260e6a7e405b1c04bf14f3fd4c7ffd892d30f8dd823cbdee56e1337ce75ceb76ea91d6745bbcd096bdf7ebda26d35db2d8d940cedf2bfb123
SSDEEP 96:7IGw4chUswqlolznnGpItMEqzAiwIyNjaM:7SHwqixG+X3Z
TLSH
T1C172D94DAD3C2532C1BDB57ED7E106535E3C639F6B63502439F88DE88EC606D702619A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 20KB
SHA256 2833a533f82102c15cf25daa02be4f7eab6f8c8290dd8da31b3b173d13c4ee48
MD5 495b22da6e9895b8280f2cb5f38ef745
SHA1 c2799ac05a55958bc3af666f3f1b5f05fe20bb58
SHA512 7f630a7f2bd3a51f76a07c1503c7c3d2e3d0bb005c9da5cb43278bc8d4cedec6cc56d455cf534186bfb03b17d438eb1f7896ff49a8e382ce8e353edc9eabcacd
SSDEEP 48:7MUVFXfbOqW59MENkMwABdU9dndVd/729IvdldHlq8/Jq4qPSuVjqTq59MENkMwM:7ZbONMEqzAiwIyNjasdMEqzAiwIyNjau
TLSH
T1FB92855D593C2311C6BE283ED3E243A35E3C53DF572391703EA49DEACDC2469B0255A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 47b0fd2ebbda7cc6e7bfea78819c6962c292f9bc81496ed2389d399c6235b571
MD5 eef32c00f9fb0840054a3909c4420220
SHA1 c574a777dedf416e1ae5ab1b1b33bd6dacdb7659
SHA512 0ef96ece22f5fcddfcce1724a563bdebb103829f5446ffaf7971d65fbfa4f944023f65ac0c7e44a964a4743bd5a2a559b28a71510226bf47b17a5510056322a5
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 c88d5cb6174c1753684faf052842e636a75e45b40736d14372abf6d63fc914d3
MD5 6943218e3d2a6fcd9224a79971a84a09
SHA1 a9cce8438d2346f60b8822d21846d25860df94c2
SHA512 b4556fb7f6d2665c8f2d0d665216896f4762dd42a0377baf856a3807f5f1a62d4778194a178c2ee5e40c2219007be8e3612cb239b8677897a5b9d635c009d85a
SSDEEP 6:7+/l9+THn1gzRWg9bNFlEuWdN/kPlOERX4PBX4ogLugMBX4suuKen:7+tmyz4qLiuWdYRmBEyPbd
TLSH
T1C002C0ACE7800C13C83D167790D887481D00F728C173CB1716B018B43D076CCE4A0E04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/user/0/cc.bomber/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 27075b859718b3fffb920143325f335a41971bfbf0574082b680f32cfe3fb44e
MD5 1d5c96ed256322a3bd4449997bd574c4
SHA1 98244c801ba8731600e01c81f0a8a7c28d5494fc
SHA512 4fb54ac778b1908faa35a618ade2e0a0a7d21a4b621996f5539dcd71026951b934f99200827764d2e0d98a73ec7819db28ec55c76131fbb8ba283bb22d9c6c12
SSDEEP 6:7+/l9zipPg9bNFlLde/kPlOERX4PBX4ogLugMBX4suuKo7M/l:7+tRiVqLJdeWRmBEyPbel
TLSH
T1B10222C963440C03C0295777B0DA83441E10A72E9223CB1B16A108942C876CCACE8D80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 bbcdf8bbbdd63ba2fd469fa4e1c9d7be4a055eff1e4a754346af5b90f43c6513
MD5 3398cd0a9d0d934975dd973a4517bd16
SHA1 ac4a5668eec10670d4438cecb4831df82868db3c
SHA512 ee471ddc58de3d366880d9a9f5fb1f6deeb72a2ce5dcae4ec5c5fbb89fefc8641c2c8a3862e9e1ab144e721f2cd7d3ea0f5faeedb1c53aeca477a7efb1f34ec2
SSDEEP 12:TLWuEmO9zmzrfRmBEyPbBvOwhk/0RT/VM/QCG:TLROpmzr0GSNh/RT/aw
TLSH
T1FF72558DEB20E307E1774736E8CAE3D23D74326A4363C6077A810B5C5D8264554A1F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 efefaae52ec8aee608e89ecdba33dbf5eefe505ff6bd84afcdad6da354b66562
MD5 9ea20e0aa9f9a42947f44965ddd5cd4b
SHA1 25ed894686a8fd5ed32227689e88e0f994b807fd
SHA512 5c9fea2a5a6009c69ce7be3fa6b6632165d0b63b59930e9d1b1a97e8db05fae2ebebca165dc40a7b797184f3e26d8734e5b4c29e23d9badda451d1fcb51206ae
SSDEEP 12:TLiEq9zmzrfRmBEyPbP/3p/0RT/VM/QCG:TL4pmzr0GSP/3SRT/aw
TLSH
T19B7255CDFA209703E273477AA4CAD3D23C24326A4363C9473E400A2C5E8264590A1F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 b22025526681cf673bef350e683838128f92f772cd4d999fcf9edcd6d1740231
MD5 71bb9e12c83f84da9c38b111d81e3bea
SHA1 8572991fd763895421f1f73ef5d01eeb5bdbce9d
SHA512 415667ea9843dcab3ad82f8bf99ea40be96da01aa355bb355b87d0ce6d96119c34152297d1f698b73b57ada4aa6e7c4be01272c74a85d2c32d285e8c959b8093
SSDEEP 12:TL1E39zmzrfRmBEyPbP/hZt1kn+/0Fl6HX4p/0RT/VM/QCG:TLopmzr0GSP/hZtunlFvSRT/aw
TLSH
T18F72598DBB10D707F177477264CBD7E32C3832658763C6163E451B5C6D8268151A1F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 d7557ada7e8a5bb580f58a660022ecf31f1e5d23d1e152f07e7e1ee4814326be
MD5 293929c35b4e7fe2604cdee7dd0bd57a
SHA1 84370cacd71f87b7115533111cc93b392238c058
SHA512 05ad7f4659d0ce49d989b0a99f023021197bbe6a611ca5b52914f651c3a5807d31622721c7d6ef306d4c74acddf34c0b222f997a67d1bc16b1e64325ca6fdd73
SSDEEP 12:TLIEU9zmzrfRmBEyPbP/QH49blqYFlM0On+/0Fl6HX4p/0RT/VM/QCG:TLYpmzr0GSP/s499FJOnlFvSRT/aw
TLSH
T16B727DCDB624D707F277473561C7D7D23C3832664363C6567E061B1C1D8274292A1F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 8a96b727366e23ae08f1b2c13f4bb861433aaf29d55686b444fffe839729e177
MD5 2f795716fb03afcca74583c3d310b188
SHA1 3a153d88360dc4be4cc577489e18030c9c3e81e6
SHA512 c9b7fd6d249d5711ec4e2876b08cf93db648cbeec755d14d9ea436bad352f18d50d21a016c9142494e6c3af7bb327bbd2542e4af975aec5c611b4164bba90f34
SSDEEP 24:TL6vpmzr0GSP/ogKabCCb3+X499FJOnlFvSRT/aw:T2vArSP/oFabCCbuI5JOnvip
TLSH
T121728989B668CB03F2B34B3951C7DBC2383832A74767D6137E461B1D2C8278281B1B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

google_app_measurement_local.db

Path /data/user/0/cc.bomber/databases/google_app_measurement_local.db
Size 16KB
SHA256 d1fe0e080a60120399f0503203950328cccc0b6eb35442f2090f3901659af522
MD5 dc113271a5e6b71a9c38496c495653a8
SHA1 4c8eb309ec46301e66952d1f92e601101304ec96
SHA512 8cf98c24e7a937ad8e04bce6864fef08e0f71e6326c3c63321e19572550cb87baaa6dd14fb953b3c4e7a74bb3d4eab12dafa0bc3d8ee1c88054b04c2dbbbfaec
SSDEEP 6:l9bNFlaLOls1TnlO0yAgLusi2JLnrcERX4PBX4ogLugMBX4suuK+/WEr/:TL5ED9zmzrfRmBEyPbP/WEr
TLSH
T15E72C28D9F102607D77247B378C99361BC24622D8377AB572BE50570AE434899052F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download